Group admin cannot change settings in user management

[michag86]

Nextcloud 11 and Nextcloud 12 are affected.

cc @MorrisJobke @rullzer

Steps to reproduce

1. login as group admin
2. open the user management
3. open the settings (bottom left)
4. enable or disable one of the checkboxes

Expected behaviour

group admin can temporarly change the settings to view email address, last login and so on

Actual behaviour

error is show "Problem loading page, reloading in ... seconds"
umgmt_send_email, umgmt_show_email, umgmt_show_last_login, umgmt_show_backend, umgmt_show_storage_location are resulting in error 401

Server configuration

Operating system: Linux darkvoice 4.4.0-79-generic #100-Ubuntu SMP Wed May 17 19:58:14 UTC 2017 x86_64

Web server: Apache (apache2handler)

Database: sqlite3 3.11.0

PHP version: 7.0.18-0ubuntu0.16.04.1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, apache2handler, mysqlnd, PDO, xml, apcu, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, imap, intl, json, ldap, exif, mcrypt, mysqli, pdo_mysql, pdo_sqlite, Phar, posix, pspell, readline, shmop, SimpleXML, soap, sockets, sqlite3, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache

Nextcloud version: 12.0.0 - 12.0.0.29

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from:

Signing status:

Signing status

[]

List of activated apps:

App list

``` Enabled: - activity: 2.5.2 - bruteforcesettings: 1.0.2 - calendar: 1.5.3 - circles: 0.10.0 - comments: 1.2.0 - contacts: 1.5.3 - dav: 1.3.0 - external: 2.0.3 - federatedfilesharing: 1.2.0 - federation: 1.2.0 - files: 1.7.2 - files_pdfviewer: 1.1.1 - files_sharing: 1.4.0 - files_texteditor: 2.4.1 - files_trashbin: 1.2.0 - files_versions: 1.5.0 - files_videoplayer: 1.1.0 - firstrunwizard: 2.1 - gallery: 17.0.0 - groupfolders: 1.0.2 - impersonate: 1.0.1 - issuetemplate: 0.2.1 - logreader: 2.0.0 - lookup_server_connector: 1.0.0 - nextcloud_announcements: 1.1 - notifications: 2.0.0 - oauth2: 1.0.5 - password_policy: 1.2.2 - provisioning_api: 1.2.0 - richdocuments: 1.12.31 - serverinfo: 1.2.0 - sharebymail: 1.2.0 - socialsharing_email: 1.0.1 - spreed: 2.0.1 - survey_client: 1.0.0 - systemtags: 1.2.0 - theming: 1.3.0 - twofactor_backupcodes: 1.1.1 - updatenotification: 1.2.0 - workflowengine: 1.2.0

Disabled:

• admin_audit
• encryption
• files_external
• user_external
• user_ldap

</details>

**The content of config/config.php:**
<details>
	<summary>Config report</summary>

{
"instanceid": "ocx4xxpub6of",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"ms07.de"
],
"datadirectory": "/var/www/htdocs/testnc/data",
"overwrite.cli.url": "https://ms07.de/testnc",
"dbtype": "sqlite3",
"version": "12.0.0.29",
"installed": true,
"updater.release.channel": "beta",
"maintenance": false,
"loglevel": 2,
"mail_smtpmode": "sendmail",
"mail_smtpauthtype": "LOGIN",
"mail_from_address": "testnc",
"mail_domain": "ms07.de",
"theme": ""
}

</details>

**Are you using external storage, if yes which one:** files_external is disabled

**Are you using encryption:** no

**Are you using an external user-backend, if yes which one:** LDAP/ActiveDirectory/Webdav/...

### Client configuration
**Browser:** Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0

**Operating system:**

### Logs
#### Web server error log
<details>
	<summary>Web server error log</summary>
	```
	Insert your webserver log here
	```
</details>

#### Nextcloud log (data/nextcloud.log)
<details>
	<summary>Nextcloud log</summary>
	```
	Insert your Nextcloud log here
	```
</details>

#### Browser log
<details>
	<summary>Browser log</summary>
	```
	Insert your browser log here, this could for example include:

	a) The javascript console log
	b) The network log
	c) ...
	```
</details>

[MorrisJobke]

@nickvergessen Those are global settings and not per user, right?

[nickvergessen]

Yeah stored in appconfig and changed via admin only endpoint. Would need to either move them to user preferences or create a duplicate endpoint also for group admins

[nickvergessen]

Id go ahead and remove the settings for group admins

[michag86]

But it would be useful to have this settings enabled temporary for group admins.

[michag86]

@MorrisJobke @nickvergessen what about only calling OCP.AppConfig.setValue('core', 'umgmt_...', 'true',... if the user is an admin?

[nickvergessen]

Sounds like a good idea

[MorrisJobke]

Will be fixed in 12.0.1 and 13